@aitne/daemon 0.1.0

package/dist/services/mcp/session-materializer.d.ts

@@ -0,0 +1,123 @@
+import type Database from "better-sqlite3";
+import type { BackendId } from "@aitne/shared";
+import type { EncryptedBlobStore } from "../../secrets/encrypted-blob-store.js";
+import { scopedEnvVarName } from "./generators/types.js";
+import type { McpServer } from "./types.js";
+/**
+ * Byte cap for the rendered `## MCP tools available` section in an
+ * instruction file. Mirrors the per-policy-file cap in policy-files.ts so a
+ * single MCP server with many long-described tools can't inflate CLAUDE.md
+ * past the prompt-cache-friendly range.
+ */
+export declare const MCP_SECTION_MAX_BYTES: number;
+export interface McpSessionMaterialization {
+    /** Enabled servers targeting this backend, in DB order (for callers / logging). */
+    servers: readonly McpServer[];
+    /**
+     * Env variables that must be exported into the spawned agent process.
+     * Keys are `scopedEnvVarName(serverId, keyName)`; values are the resolved
+     * secret. Missing secrets are simply omitted — the backend will fail at
+     * call time rather than the daemon silently substituting an empty string.
+     */
+    env: Record<string, string>;
+    /** Absolute path of the config file written into the session workdir, or null when no MCP targets this backend. */
+    configPath: string | null;
+    /**
+     * Claude-only: the object-shape the SDK's `mcpServers` option accepts.
+     * Null for Codex / Gemini (they only read the file). Generated from the
+     * same JSON content so the file and the in-memory shape never drift.
+     */
+    claudeMcpServers: Record<string, unknown> | null;
+    /** Tool names to append to the session's `disallowedTools`. */
+    disallowedTools: string[];
+}
+export interface MaterializeMcpParams {
+    db: Database.Database;
+    blobStore: EncryptedBlobStore;
+    sessionDir: string;
+    backendId: BackendId;
+    /**
+     * Whether the session is autonomous (routine / scheduled task). Controls
+     * the approve-tier strip in `buildMcpDisallowedTools`.
+     */
+    autonomous: boolean;
+    /**
+     * Resolved vault context dir (result of `getContextDir(config)`). Used
+     * only to decide whether the agent-facing MCP section should mention
+     * `rules/mcp.md`. Optional so tests and internal callers without a
+     * config handle can still materialize; when omitted the reference is
+     * silently dropped instead of pointing at a non-existent file.
+     */
+    contextDir?: string;
+}
+/**
+ * B-003 Phase 3 — idempotent per-session MCP materialization.
+ *
+ * Called by every agent core before handing off to the backend. Resolves
+ * secrets, runs the backend's config-file generator, writes the file
+ * atomically, and replaces the `## MCP tools available` section in the
+ * instruction file in-place.
+ *
+ * Returns everything the caller needs to:
+ *   - extend spawn env (`env`)
+ *   - pass `mcpServers` to Claude's `query()` (`claudeMcpServers`)
+ *   - merge blocks into `disallowedTools` (`disallowedTools`)
+ *
+ * Safe to call when no MCP servers target this backend: the helper short-
+ * circuits to an empty return rather than writing an empty config file,
+ * which would let a misconfigured backend still attempt to load MCP.
+ */
+export declare function materializeMcpForSession(params: MaterializeMcpParams): Promise<McpSessionMaterialization>;
+export interface RenderMcpSectionOptions {
+    /**
+     * Backend this section is being rendered for. The servers list is already
+     * filtered to this backend by the caller; the id is surfaced in the
+     * agent-facing text so a routine triaging multi-backend MCP coverage
+     * doesn't assume it sees every server every session.
+     */
+    backendId?: BackendId;
+    /**
+     * Autonomous sessions strip every `approve`-tier server's tools via
+     * `buildMcpDisallowedTools`. When true, we also replace the per-server
+     * tool list with a one-line explanation so the model doesn't waste turns
+     * trying to invoke blocked tools.
+     */
+    autonomous?: boolean;
+    /**
+     * Whether `<contextDir>/rules/mcp.md` exists. When false, the agent-facing
+     * section no longer tells the model to consult a file that doesn't exist —
+     * prevents spurious `curl` hunts in DMs and routines.
+     */
+    rulesFileExists?: boolean;
+    /** Hard cap on the rendered section size. Defaults to `MCP_SECTION_MAX_BYTES`. */
+    maxBytes?: number;
+}
+/**
+ * Render the agent-facing `## MCP tools available` block.
+ *
+ * Size-bounded: emits `MCP_SECTION_END` unconditionally and truncates per-
+ * server tool lists (and the server list itself) rather than blow past the
+ * caller's byte budget. Allowlist-aware: probe tools outside the allowlist
+ * are hidden, matching the SDK's `disallowedTools` enforcement so the model
+ * never sees a tool it can't actually call. Autonomous-aware: approve-tier
+ * servers render the block with a "blocked this turn" note in place of the
+ * tool enumeration.
+ */
+export declare function renderMcpSection(servers: readonly McpServer[], options?: RenderMcpSectionOptions): string;
+export { scopedEnvVarName };
+/**
+ * Recursively substitute `${VAR}` placeholders in string values using
+ * `env` as the lookup table. Designed for the Claude in-memory
+ * `mcpServers` object where the SDK accepts nested `Record<string, string>`
+ * for headers / env but does not perform its own env-var expansion.
+ *
+ * Missing variables are left as the literal placeholder — the same
+ * behavior as failing the request, so the agent sees a visible
+ * `${MCP_FOO_BAR}` auth string rather than an empty header that would
+ * produce a 401 with no obvious clue.
+ *
+ * Exported for the test; kept here (rather than in `./risk.ts`) because
+ * it is tightly coupled to the generator's placeholder format.
+ */
+export declare function resolvePlaceholdersDeep<T>(value: T, env: Record<string, string>): T;
+//# sourceMappingURL=session-materializer.d.ts.map

package/dist/services/mcp/session-materializer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-materializer.d.ts","sourceRoot":"","sources":["../../../src/services/mcp/session-materializer.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAIhF,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG5C;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,QAAY,CAAC;AAoC/C,MAAM,WAAW,yBAAyB;IACxC,mFAAmF;IACnF,OAAO,EAAE,SAAS,SAAS,EAAE,CAAC;IAC9B;;;;;OAKG;IACH,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,mHAAmH;IACnH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;OAIG;IACH,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACjD,+DAA+D;IAC/D,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;IACtB,SAAS,EAAE,kBAAkB,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB;;;OAGG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,yBAAyB,CAAC,CAgIpC;AA8BD,MAAM,WAAW,uBAAuB;IACtC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,SAAS,SAAS,EAAE,EAC7B,OAAO,GAAE,uBAA4B,GACpC,MAAM,CA8GR;AAuCD,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAE5B;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,EACvC,KAAK,EAAE,CAAC,EACR,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC1B,CAAC,CAkBH"}

package/dist/services/mcp/session-materializer.js

@@ -0,0 +1,361 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { randomBytes } from "node:crypto";
+import { createLogger } from "../../logging.js";
+import { listMcpServers, resolveMcpSecrets } from "./registry.js";
+import { generateMcpConfig } from "./generators/index.js";
+import { scopedEnvVarName } from "./generators/types.js";
+import { buildMcpDisallowedTools } from "./risk.js";
+/**
+ * Byte cap for the rendered `## MCP tools available` section in an
+ * instruction file. Mirrors the per-policy-file cap in policy-files.ts so a
+ * single MCP server with many long-described tools can't inflate CLAUDE.md
+ * past the prompt-cache-friendly range.
+ */
+export const MCP_SECTION_MAX_BYTES = 32 * 1024;
+const logger = createLogger("mcp-session-materializer");
+/**
+ * Instruction file name per backend, matching `SkillsCompiler.materializeSession*`.
+ */
+const INSTRUCTION_FILES = {
+    claude: "CLAUDE.md",
+    codex: "AGENTS.md",
+    gemini: "GEMINI.md",
+};
+/**
+ * Per-backend MCP config file path, relative to the session workdir. Must
+ * match whatever each generator returns in its `path` field. When no MCP
+ * servers target the backend, we delete the file here so the backend's own
+ * loader (Claude SDK reading `.mcp.json` from cwd; Codex reading
+ * `.codex/config.toml`; Gemini reading `.gemini/settings.json`) cannot pick
+ * up a stale config from a prior materialize.
+ */
+const BACKEND_CONFIG_PATHS = {
+    claude: ".mcp.json",
+    codex: ".codex/config.toml",
+    gemini: ".gemini/settings.json",
+};
+/**
+ * Marker used to delimit the appendable MCP section in an instruction file
+ * so repeat materialization replaces the block in-place instead of stacking
+ * duplicates. The `<!-- -->` comment style survives every backend's
+ * markdown renderer and is ignored by the agent when it reads the file.
+ */
+const MCP_SECTION_BEGIN = "<!-- pa:mcp-section:begin -->";
+const MCP_SECTION_END = "<!-- pa:mcp-section:end -->";
+/**
+ * B-003 Phase 3 — idempotent per-session MCP materialization.
+ *
+ * Called by every agent core before handing off to the backend. Resolves
+ * secrets, runs the backend's config-file generator, writes the file
+ * atomically, and replaces the `## MCP tools available` section in the
+ * instruction file in-place.
+ *
+ * Returns everything the caller needs to:
+ *   - extend spawn env (`env`)
+ *   - pass `mcpServers` to Claude's `query()` (`claudeMcpServers`)
+ *   - merge blocks into `disallowedTools` (`disallowedTools`)
+ *
+ * Safe to call when no MCP servers target this backend: the helper short-
+ * circuits to an empty return rather than writing an empty config file,
+ * which would let a misconfigured backend still attempt to load MCP.
+ */
+export async function materializeMcpForSession(params) {
+    const allServers = listMcpServers(params.db);
+    const forBackend = allServers.filter((s) => s.enabled && s.backends.includes(params.backendId));
+    if (forBackend.length === 0) {
+        // Nothing to write. Still strip the instruction-file section in case a
+        // previous session wrote one and the user has since disabled all MCPs
+        // — otherwise the agent would see a stale tool menu.
+        stripMcpSection(params.sessionDir, params.backendId);
+        // Also remove the on-disk config file. Without this, the backend's own
+        // loader (Claude SDK's `.mcp.json`, Codex's `.codex/config.toml`,
+        // Gemini's `.gemini/settings.json`) would still find a stale config
+        // from an earlier materialize and try to connect to disabled/removed
+        // servers — with `${MCP_…}` env placeholders that are no longer set in
+        // the spawn env, resulting in silent auth failures. For Codex stdio,
+        // the stale file also contains inlined secret values, so deletion is
+        // the defense-in-depth story too.
+        const stalePath = join(params.sessionDir, BACKEND_CONFIG_PATHS[params.backendId]);
+        try {
+            rmSync(stalePath, { force: true });
+        }
+        catch (err) {
+            /* c8 ignore next — `force: true` swallows ENOENT and most other
+               common failure modes; this guards against EACCES on a workdir the
+               daemon owns, which shouldn't happen in practice. */
+            logger.warn({ err, path: stalePath, backendId: params.backendId }, "Failed to remove stale MCP config file");
+        }
+        return {
+            servers: [],
+            env: {},
+            configPath: null,
+            claudeMcpServers: null,
+            disallowedTools: [],
+        };
+    }
+    // Resolve secrets for every (enabled, backend-targeted) server.
+    const scopedSecrets = {};
+    for (const server of forBackend) {
+        const raw = await resolveMcpSecrets(params.blobStore, server);
+        for (const [keyName, value] of Object.entries(raw)) {
+            if (value == null)
+                continue;
+            scopedSecrets[`${server.id}:${keyName}`] = value;
+        }
+    }
+    const generated = generateMcpConfig(params.backendId, forBackend, {
+        secrets: scopedSecrets,
+    });
+    const absConfigPath = join(params.sessionDir, generated.path);
+    writeAtomic(absConfigPath, generated.contents);
+    const rulesFileExists = params.contextDir
+        ? existsSync(join(params.contextDir, "rules/mcp.md"))
+        : false;
+    appendMcpSection(params.sessionDir, params.backendId, forBackend, {
+        backendId: params.backendId,
+        autonomous: params.autonomous,
+        rulesFileExists,
+    });
+    const disallowedTools = buildMcpDisallowedTools({
+        servers: forBackend,
+        autonomous: params.autonomous,
+    });
+    // For Claude, parse the generated JSON back into the `mcpServers` shape the
+    // SDK accepts. Unlike the on-disk `.mcp.json` (which Claude Code's config
+    // loader expands `${VAR}` references in), the in-memory object handed to
+    // `query()` has no documented expansion step — the Agent SDK's
+    // `McpHttpServerConfig.headers` type is just `Record<string, string>`.
+    // If we pass literal `${MCP_…}` values, every request would ship that
+    // string as the Authorization header and silently 401. So for the Claude
+    // path specifically we substitute the placeholders with the resolved env
+    // values here. The `.mcp.json` on disk keeps placeholders so a user who
+    // inspects the file sees the intent, and so a CLI-invoked session (which
+    // does expand) still works.
+    let claudeMcpServers = null;
+    if (params.backendId === "claude") {
+        /* c8 ignore start — the Claude generator always emits `{ mcpServers:
+           {...} }` as valid JSON, so both the ternary's falsy branch and the
+           catch arm are unreachable under current code. Both are kept as
+           defensive guards against a future generator regression or a file-
+           system tamper that corrupts the already-written `.mcp.json`. The
+           happy path is exercised by the test above. */
+        try {
+            const parsed = JSON.parse(generated.contents);
+            claudeMcpServers = parsed.mcpServers
+                ? resolvePlaceholdersDeep(parsed.mcpServers, generated.env)
+                : null;
+        }
+        catch (err) {
+            logger.warn({ err, path: generated.path }, "Failed to re-parse generated Claude MCP config for SDK; falling back to file-only");
+        }
+        /* c8 ignore stop */
+    }
+    logger.info({
+        sessionDir: params.sessionDir,
+        backendId: params.backendId,
+        servers: forBackend.map((s) => s.id),
+        disallowedCount: disallowedTools.length,
+        envKeys: Object.keys(generated.env).length,
+    }, "MCP materialized for session");
+    return {
+        servers: forBackend,
+        env: generated.env,
+        configPath: absConfigPath,
+        claudeMcpServers,
+        disallowedTools,
+    };
+}
+/**
+ * Atomic write: stage to `<path>.tmp-<rand>` then rename. Prevents a reader
+ * from seeing a half-written config if the agent spawns concurrently with
+ * materialization (unlikely but cheap to guarantee).
+ */
+function writeAtomic(path, contents) {
+    mkdirSync(dirname(path), { recursive: true });
+    const tmpPath = `${path}.tmp-${randomBytes(6).toString("hex")}`;
+    writeFileSync(tmpPath, contents, { encoding: "utf-8", mode: 0o600 });
+    renameSync(tmpPath, path);
+}
+function appendMcpSection(sessionDir, backendId, servers, options) {
+    const instructionFile = join(sessionDir, INSTRUCTION_FILES[backendId]);
+    const body = renderMcpSection(servers, options);
+    replaceOrAppendSection(instructionFile, body);
+}
+function stripMcpSection(sessionDir, backendId) {
+    const instructionFile = join(sessionDir, INSTRUCTION_FILES[backendId]);
+    replaceOrAppendSection(instructionFile, null);
+}
+/**
+ * Render the agent-facing `## MCP tools available` block.
+ *
+ * Size-bounded: emits `MCP_SECTION_END` unconditionally and truncates per-
+ * server tool lists (and the server list itself) rather than blow past the
+ * caller's byte budget. Allowlist-aware: probe tools outside the allowlist
+ * are hidden, matching the SDK's `disallowedTools` enforcement so the model
+ * never sees a tool it can't actually call. Autonomous-aware: approve-tier
+ * servers render the block with a "blocked this turn" note in place of the
+ * tool enumeration.
+ */
+export function renderMcpSection(servers, options = {}) {
+    const { backendId, autonomous = false, rulesFileExists = false, maxBytes = MCP_SECTION_MAX_BYTES, } = options;
+    const lines = [];
+    let bytes = 0;
+    const endLine = MCP_SECTION_END;
+    const endReserve = Buffer.byteLength(endLine, "utf-8") + 2;
+    const push = (line) => {
+        lines.push(line);
+        bytes += Buffer.byteLength(line, "utf-8") + 1; // +1 for newline join
+    };
+    const wouldFit = (line) => bytes + Buffer.byteLength(line, "utf-8") + 1 + endReserve <= maxBytes;
+    push(MCP_SECTION_BEGIN);
+    push("");
+    push("## MCP tools available");
+    push("");
+    push(backendId
+        ? `The following MCP servers are enabled for this session (backend: \`${backendId}\`).`
+        : "The following MCP servers are enabled.");
+    if (rulesFileExists) {
+        push("Consult `rules/mcp.md` for per-server usage rules.");
+    }
+    push("");
+    let truncatedServers = 0;
+    for (let i = 0; i < servers.length; i++) {
+        const server = servers[i];
+        const headerLine = `### ${server.name} (\`${server.id}\`)`;
+        if (!wouldFit(headerLine)) {
+            truncatedServers = servers.length - i;
+            break;
+        }
+        push(headerLine);
+        push("");
+        push(`Risk tier: \`${server.riskTier}\``);
+        const autonomouslyBlocked = autonomous && server.riskTier === "approve";
+        if (autonomouslyBlocked) {
+            push("");
+            push("_Tools from this approve-tier server are blocked in the current autonomous session. Surface an observation if the owner needs to intervene._");
+        }
+        const allowlist = server.toolAllowlist;
+        const probeTools = server.lastProbeStatus?.tools ?? [];
+        // Filter probe results by allowlist so the agent-visible tool list is
+        // exactly the set the SDK will actually let through. `disallowedTools`
+        // still enforces this server-side; hiding non-allowlisted tools here
+        // avoids repeated "tool not available" retries from the model.
+        const visibleTools = allowlist && allowlist.length > 0
+            ? probeTools.filter((t) => allowlist.includes(t.name))
+            : probeTools;
+        if (allowlist && allowlist.length > 0) {
+            push(`Allowed tools: ${allowlist.map((t) => `\`${t}\``).join(", ")}`);
+        }
+        if (!autonomouslyBlocked) {
+            push("");
+            if (probeTools.length === 0) {
+                push("_No probe results recorded. Run a probe to enumerate tools._");
+            }
+            else if (visibleTools.length === 0) {
+                push("_No probed tools match the allowlist._");
+            }
+            else {
+                let emitted = 0;
+                let truncated = false;
+                for (const tool of visibleTools) {
+                    const desc = tool.description ? ` — ${tool.description}` : "";
+                    const line = `- \`${tool.name}\`${desc}`;
+                    if (!wouldFit(line)) {
+                        truncated = true;
+                        break;
+                    }
+                    push(line);
+                    emitted++;
+                }
+                if (truncated) {
+                    push(`_…${visibleTools.length - emitted} more tools truncated (section size cap reached)._`);
+                }
+            }
+        }
+        push("");
+    }
+    if (truncatedServers > 0) {
+        // These pushes deliberately bypass `wouldFit`: we held back `endReserve`
+        // bytes exactly so the truncation notice + end marker always land.
+        lines.push(`_…${truncatedServers} more server(s) truncated (section size cap reached)._`);
+        lines.push("");
+    }
+    lines.push(endLine);
+    return lines.join("\n");
+}
+/**
+ * Replace the marker-delimited block in `path` with `body`. When `body` is
+ * null the block is removed entirely. When no marker exists and `body` is
+ * non-null the block is appended. Missing instruction files are left alone
+ * — the skills compiler writes them first; if the file is absent something
+ * upstream has gone wrong and we don't want to paper over it here.
+ */
+function replaceOrAppendSection(path, body) {
+    let current;
+    try {
+        current = readFileSync(path, "utf-8");
+    }
+    catch {
+        logger.debug({ path }, "instruction file missing; skipping MCP section write");
+        return;
+    }
+    const beginIdx = current.indexOf(MCP_SECTION_BEGIN);
+    const endIdx = current.indexOf(MCP_SECTION_END);
+    let next;
+    if (beginIdx >= 0 && endIdx > beginIdx) {
+        const before = current.slice(0, beginIdx).trimEnd();
+        const after = current.slice(endIdx + MCP_SECTION_END.length).trimStart();
+        if (body === null) {
+            next = `${before}\n${after ? after + "\n" : ""}`;
+        }
+        else {
+            next = `${before}\n\n${body}\n${after ? "\n" + after : ""}`.trimEnd() + "\n";
+        }
+    }
+    else {
+        if (body === null)
+            return; // nothing to do
+        next = `${current.trimEnd()}\n\n${body}\n`;
+    }
+    if (next !== current) {
+        writeFileSync(path, next, { encoding: "utf-8", mode: 0o600 });
+    }
+}
+// Re-export for convenient use from agent cores that want to mint env var
+// names without depending on generators/types directly.
+export { scopedEnvVarName };
+/**
+ * Recursively substitute `${VAR}` placeholders in string values using
+ * `env` as the lookup table. Designed for the Claude in-memory
+ * `mcpServers` object where the SDK accepts nested `Record<string, string>`
+ * for headers / env but does not perform its own env-var expansion.
+ *
+ * Missing variables are left as the literal placeholder — the same
+ * behavior as failing the request, so the agent sees a visible
+ * `${MCP_FOO_BAR}` auth string rather than an empty header that would
+ * produce a 401 with no obvious clue.
+ *
+ * Exported for the test; kept here (rather than in `./risk.ts`) because
+ * it is tightly coupled to the generator's placeholder format.
+ */
+export function resolvePlaceholdersDeep(value, env) {
+    if (typeof value === "string") {
+        return value.replace(/\$\{([A-Z0-9_]+)\}/g, (match, name) => {
+            const resolved = env[name];
+            return resolved === undefined ? match : resolved;
+        });
+    }
+    if (Array.isArray(value)) {
+        return value.map((v) => resolvePlaceholdersDeep(v, env));
+    }
+    if (value !== null && typeof value === "object") {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            out[k] = resolvePlaceholdersDeep(v, env);
+        }
+        return out;
+    }
+    return value;
+}
+//# sourceMappingURL=session-materializer.js.map

package/dist/services/mcp/session-materializer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-materializer.js","sourceRoot":"","sources":["../../../src/services/mcp/session-materializer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI1C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/C,MAAM,MAAM,GAAG,YAAY,CAAC,0BAA0B,CAAC,CAAC;AAExD;;GAEG;AACH,MAAM,iBAAiB,GAA8B;IACnD,MAAM,EAAE,WAAW;IACnB,KAAK,EAAE,WAAW;IAClB,MAAM,EAAE,WAAW;CACpB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAA8B;IACtD,MAAM,EAAE,WAAW;IACnB,KAAK,EAAE,oBAAoB;IAC3B,MAAM,EAAE,uBAAuB;CAChC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,+BAA+B,CAAC;AAC1D,MAAM,eAAe,GAAG,6BAA6B,CAAC;AA4CtD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAA4B;IAE5B,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAClC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAC1D,CAAC;IAEF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,uEAAuE;QACvE,sEAAsE;QACtE,qDAAqD;QACrD,eAAe,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACrD,uEAAuE;QACvE,kEAAkE;QAClE,oEAAoE;QACpE,qEAAqE;QACrE,uEAAuE;QACvE,qEAAqE;QACrE,qEAAqE;QACrE,kCAAkC;QAClC,MAAM,SAAS,GAAG,IAAI,CACpB,MAAM,CAAC,UAAU,EACjB,oBAAoB,CAAC,MAAM,CAAC,SAAS,CAAC,CACvC,CAAC;QACF,IAAI,CAAC;YACH,MAAM,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb;;kEAEsD;YACtD,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EACrD,wCAAwC,CACzC,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,EAAE;YACX,GAAG,EAAE,EAAE;YACP,UAAU,EAAE,IAAI;YAChB,gBAAgB,EAAE,IAAI;YACtB,eAAe,EAAE,EAAE;SACpB,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,MAAM,aAAa,GAA2B,EAAE,CAAC;IACjD,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9D,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,IAAI,KAAK,IAAI,IAAI;gBAAE,SAAS;YAC5B,aAAa,CAAC,GAAG,MAAM,CAAC,EAAE,IAAI,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC;QACnD,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE;QAChE,OAAO,EAAE,aAAa;KACvB,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9D,WAAW,CAAC,aAAa,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IAE/C,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU;QACvC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QACrD,CAAC,CAAC,KAAK,CAAC;IAEV,gBAAgB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE;QAChE,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,eAAe;KAChB,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,uBAAuB,CAAC;QAC9C,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC,CAAC;IAEH,4EAA4E;IAC5E,0EAA0E;IAC1E,yEAAyE;IACzE,+DAA+D;IAC/D,uEAAuE;IACvE,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,wEAAwE;IACxE,yEAAyE;IACzE,4BAA4B;IAC5B,IAAI,gBAAgB,GAAmC,IAAI,CAAC;IAC5D,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC;;;;;wDAKgD;QAChD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAE3C,CAAC;YACF,gBAAgB,GAAG,MAAM,CAAC,UAAU;gBAClC,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC;gBAC3D,CAAC,CAAC,IAAI,CAAC;QACX,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,EAC7B,mFAAmF,CACpF,CAAC;QACJ,CAAC;QACD,oBAAoB;IACtB,CAAC;IAED,MAAM,CAAC,IAAI,CACT;QACE,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,eAAe,EAAE,eAAe,CAAC,MAAM;QACvC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM;KAC3C,EACD,8BAA8B,CAC/B,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,UAAU;QACnB,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,UAAU,EAAE,aAAa;QACzB,gBAAgB;QAChB,eAAe;KAChB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,IAAY,EAAE,QAAgB;IACjD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,GAAG,IAAI,QAAQ,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAChE,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,gBAAgB,CACvB,UAAkB,EAClB,SAAoB,EACpB,OAA6B,EAC7B,OAAgC;IAEhC,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,sBAAsB,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB,EAAE,SAAoB;IAC/D,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;IACvE,sBAAsB,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;AAChD,CAAC;AA2BD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAA6B,EAC7B,UAAmC,EAAE;IAErC,MAAM,EACJ,SAAS,EACT,UAAU,GAAG,KAAK,EAClB,eAAe,GAAG,KAAK,EACvB,QAAQ,GAAG,qBAAqB,GACjC,GAAG,OAAO,CAAC;IAEZ,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,eAAe,CAAC;IAChC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAE3D,MAAM,IAAI,GAAG,CAAC,IAAY,EAAQ,EAAE;QAClC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,sBAAsB;IACvE,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAW,EAAE,CACzC,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,IAAI,QAAQ,CAAC;IAExE,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACxB,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC/B,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,IAAI,CACF,SAAS;QACP,CAAC,CAAC,sEAAsE,SAAS,MAAM;QACvF,CAAC,CAAC,wCAAwC,CAC7C,CAAC;IACF,IAAI,eAAe,EAAE,CAAC;QACpB,IAAI,CAAC,oDAAoD,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,CAAC;IAET,IAAI,gBAAgB,GAAG,CAAC,CAAC;IAEzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,UAAU,GAAG,OAAO,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,CAAC;QAC3D,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1B,gBAAgB,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;YACtC,MAAM;QACR,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,IAAI,CAAC,EAAE,CAAC,CAAC;QACT,IAAI,CAAC,gBAAgB,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;QAE1C,MAAM,mBAAmB,GACvB,UAAU,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC;QAC9C,IAAI,mBAAmB,EAAE,CAAC;YACxB,IAAI,CAAC,EAAE,CAAC,CAAC;YACT,IAAI,CACF,8IAA8I,CAC/I,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,CAAC;QACvC,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC;QACvD,sEAAsE;QACtE,uEAAuE;QACvE,qEAAqE;QACrE,+DAA+D;QAC/D,MAAM,YAAY,GAChB,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAC/B,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACtD,CAAC,CAAC,UAAU,CAAC;QAEjB,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,kBAAkB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,IAAI,CAAC,EAAE,CAAC,CAAC;YACT,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,IAAI,CAAC,8DAA8D,CAAC,CAAC;YACvE,CAAC;iBAAM,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrC,IAAI,CAAC,wCAAwC,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,IAAI,OAAO,GAAG,CAAC,CAAC;gBAChB,IAAI,SAAS,GAAG,KAAK,CAAC;gBACtB,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;oBAChC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9D,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;oBACzC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;wBACpB,SAAS,GAAG,IAAI,CAAC;wBACjB,MAAM;oBACR,CAAC;oBACD,IAAI,CAAC,IAAI,CAAC,CAAC;oBACX,OAAO,EAAE,CAAC;gBACZ,CAAC;gBACD,IAAI,SAAS,EAAE,CAAC;oBACd,IAAI,CACF,KAAK,YAAY,CAAC,MAAM,GAAG,OAAO,oDAAoD,CACvF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC;IAED,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;QACzB,yEAAyE;QACzE,mEAAmE;QACnE,KAAK,CAAC,IAAI,CACR,KAAK,gBAAgB,wDAAwD,CAC9E,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,IAAY,EAAE,IAAmB;IAC/D,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,sDAAsD,CAAC,CAAC;QAC/E,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAChD,IAAI,IAAY,CAAC;IACjB,IAAI,QAAQ,IAAI,CAAC,IAAI,MAAM,GAAG,QAAQ,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC;QACzE,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,IAAI,GAAG,GAAG,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,GAAG,MAAM,OAAO,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;QAC/E,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,CAAC,gBAAgB;QAC3C,IAAI,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC;IAC7C,CAAC;IACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,wDAAwD;AACxD,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAE5B;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAQ,EACR,GAA2B;IAE3B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;YAClE,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;YAC3B,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;QACnD,CAAC,CAAiB,CAAC;IACrB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAiB,CAAC;IAC3E,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,CAAC,CAAC,GAAG,uBAAuB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,GAAmB,CAAC;IAC7B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/services/mcp/tool-audit.d.ts

@@ -0,0 +1,53 @@
+import type Database from "better-sqlite3";
+export interface McpToolCallRow {
+    id: number;
+    serverId: string;
+    toolName: string;
+    eventType: string | null;
+    sessionId: string | null;
+    /** null = result not yet received (Codex/Gemini) or pending (Claude mid-session). */
+    ok: boolean | null;
+    error: string | null;
+    calledAt: number;
+    /**
+     * Wall-clock ms from the SDK's `tool_use` message delivery to the matching
+     * `tool_result` message. Includes SDK internal dispatch latency between the
+     * two events. Only populated for the Claude backend; Codex and Gemini do not
+     * emit per-tool result events.
+     */
+    durationMs: number | null;
+}
+/**
+ * Record a single MCP tool invocation. Best-effort — callers must wrap in
+ * try/catch so a logging failure never interrupts the core execution path.
+ *
+ * Returns the DB row ID so the caller can later backfill the result via
+ * `updateMcpToolCallResult`. Throws on insert failure.
+ */
+export declare function logMcpToolCall(db: Database.Database, params: {
+    serverId: string;
+    toolName: string;
+    eventType?: string;
+    sessionId?: string;
+}): number;
+/**
+ * Backfill the result of a tool invocation once the tool_result block arrives.
+ * No-op if `rowId` does not match any existing row (graceful against missed
+ * inserts or unexpected stream ordering).
+ */
+export declare function updateMcpToolCallResult(db: Database.Database, rowId: number, ok: boolean, error: string | null, durationMs?: number): void;
+/**
+ * List the most-recent tool calls for a given MCP server, newest first.
+ * Returns an empty array if the table does not exist (pre-migration DB).
+ */
+export declare function listMcpToolCalls(db: Database.Database, serverId: string, limit?: number): McpToolCallRow[];
+/**
+ * Delete audit rows older than `days` days. Returns the number of rows deleted.
+ * Returns 0 silently if the table does not exist (pre-migration DB).
+ *
+ * Called by `runRetentionCleanup` as part of the daily retention sweep.
+ * Note: `called_at` is stored as epoch milliseconds (not a SQLite datetime
+ * string), so comparison uses integer arithmetic rather than datetime().
+ */
+export declare function pruneOldMcpToolCalls(db: Database.Database, days: number): number;
+//# sourceMappingURL=tool-audit.d.ts.map

package/dist/services/mcp/tool-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-audit.d.ts","sourceRoot":"","sources":["../../../src/services/mcp/tool-audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAmC3C,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,qFAAqF;IACrF,EAAE,EAAE,OAAO,GAAG,IAAI,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAgBD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,MAAM,EAAE;IACN,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,MAAM,CAcR;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,OAAO,EACX,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,UAAU,CAAC,EAAE,MAAM,GAClB,IAAI,CAIN;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,QAAQ,EAAE,MAAM,EAChB,KAAK,SAAK,GACT,cAAc,EAAE,CAelB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAShF"}

package/dist/services/mcp/tool-audit.js

@@ -0,0 +1,74 @@
+function mapRow(row) {
+    return {
+        id: row.id,
+        serverId: row.server_id,
+        toolName: row.tool_name,
+        eventType: row.event_type,
+        sessionId: row.session_id,
+        ok: row.ok === null ? null : row.ok === 1,
+        error: row.error,
+        calledAt: row.called_at,
+        durationMs: row.duration_ms,
+    };
+}
+/**
+ * Record a single MCP tool invocation. Best-effort — callers must wrap in
+ * try/catch so a logging failure never interrupts the core execution path.
+ *
+ * Returns the DB row ID so the caller can later backfill the result via
+ * `updateMcpToolCallResult`. Throws on insert failure.
+ */
+export function logMcpToolCall(db, params) {
+    const result = db
+        .prepare(`INSERT INTO mcp_tool_calls (server_id, tool_name, event_type, session_id, called_at)
+       VALUES (?, ?, ?, ?, ?)`)
+        .run(params.serverId, params.toolName, params.eventType ?? null, params.sessionId ?? null, Date.now());
+    return Number(result.lastInsertRowid);
+}
+/**
+ * Backfill the result of a tool invocation once the tool_result block arrives.
+ * No-op if `rowId` does not match any existing row (graceful against missed
+ * inserts or unexpected stream ordering).
+ */
+export function updateMcpToolCallResult(db, rowId, ok, error, durationMs) {
+    db.prepare(`UPDATE mcp_tool_calls SET ok = ?, error = ?, duration_ms = ? WHERE id = ?`).run(ok ? 1 : 0, error, durationMs ?? null, rowId);
+}
+/**
+ * List the most-recent tool calls for a given MCP server, newest first.
+ * Returns an empty array if the table does not exist (pre-migration DB).
+ */
+export function listMcpToolCalls(db, serverId, limit = 20) {
+    try {
+        const rows = db
+            .prepare(`SELECT id, server_id, tool_name, event_type, session_id, ok, error, called_at, duration_ms
+         FROM mcp_tool_calls
+         WHERE server_id = ?
+         ORDER BY called_at DESC
+         LIMIT ?`)
+            .all(serverId, limit);
+        return rows.map(mapRow);
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Delete audit rows older than `days` days. Returns the number of rows deleted.
+ * Returns 0 silently if the table does not exist (pre-migration DB).
+ *
+ * Called by `runRetentionCleanup` as part of the daily retention sweep.
+ * Note: `called_at` is stored as epoch milliseconds (not a SQLite datetime
+ * string), so comparison uses integer arithmetic rather than datetime().
+ */
+export function pruneOldMcpToolCalls(db, days) {
+    const cutoffMs = Date.now() - days * 24 * 60 * 60 * 1000;
+    try {
+        return db
+            .prepare(`DELETE FROM mcp_tool_calls WHERE called_at < ?`)
+            .run(cutoffMs).changes;
+    }
+    catch {
+        return 0;
+    }
+}
+//# sourceMappingURL=tool-audit.js.map

package/dist/services/mcp/tool-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-audit.js","sourceRoot":"","sources":["../../../src/services/mcp/tool-audit.ts"],"names":[],"mappings":"AAsDA,SAAS,MAAM,CAAC,GAAsB;IACpC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,EAAE,EAAE,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;QACzC,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,UAAU,EAAE,GAAG,CAAC,WAAW;KAC5B,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,EAAqB,EACrB,MAKC;IAED,MAAM,MAAM,GAAG,EAAE;SACd,OAAO,CACN;8BACwB,CACzB;SACA,GAAG,CACF,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,SAAS,IAAI,IAAI,EACxB,MAAM,CAAC,SAAS,IAAI,IAAI,EACxB,IAAI,CAAC,GAAG,EAAE,CACX,CAAC;IACJ,OAAO,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,EAAqB,EACrB,KAAa,EACb,EAAW,EACX,KAAoB,EACpB,UAAmB;IAEnB,EAAE,CAAC,OAAO,CACR,2EAA2E,CAC5E,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,IAAI,IAAI,EAAE,KAAK,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,EAAqB,EACrB,QAAgB,EAChB,KAAK,GAAG,EAAE;IAEV,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE;aACZ,OAAO,CACN;;;;iBAIS,CACV;aACA,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAwB,CAAC;QAC/C,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,EAAqB,EAAE,IAAY;IACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACzD,IAAI,CAAC;QACH,OAAO,EAAE;aACN,OAAO,CAAC,gDAAgD,CAAC;aACzD,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}